Baseline.
We compare LTI with TAG [1]}—the state-of-the-art language model gradient inversion attack without utilizing the token embedding layer gradientWe do not compare against a more recent attack by [2]} since it crucially depends on access to the token embedding layer gradient..
The objective function for TAG is a slight modification of eq:optobjective that uses both the \(\ell _2\)  and \(\ell _1\)  distance between the observed gradient and the gradient of dummy data. We also modify TAG slightly to adaptive it different defenses; see appendix for details.
